Microsoft Entra built-in rolePublic reference

Authentication Policy Administrator

Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.

Compare definitions Microsoft reference

Documented resource actions

19 documented actions

These are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.

Action	Description
microsoft.azure.supportTickets/allEntities/allTasks	Create and manage Azure support tickets
microsoft.directory/organization/strongAuthentication/allTasks	Manage all aspects of strong authentication properties of an organization
microsoft.directory/userCredentialPolicies/basic/update	Update basic policies for users
microsoft.directory/userCredentialPolicies/create	Create credential policies for users
microsoft.directory/userCredentialPolicies/delete	Delete credential policies for users
microsoft.directory/userCredentialPolicies/owners/read	Read owners of credential policies for users
microsoft.directory/userCredentialPolicies/owners/update	Update owners of credential policies for users
microsoft.directory/userCredentialPolicies/policyAppliedTo/read	Read policy.appliesTo navigation link
microsoft.directory/userCredentialPolicies/standard/read	Read standard properties of credential policies for users
microsoft.directory/userCredentialPolicies/tenantDefault/update	Update policy.isOrganizationDefault property
microsoft.directory/verifiableCredentials/configuration/allProperties/read	Read configuration required to create and manage verifiable credentials
microsoft.directory/verifiableCredentials/configuration/allProperties/update	Update configuration required to create and manage verifiable credentials
microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/read	Read a verifiable credential contract
microsoft.directory/verifiableCredentials/configuration/contracts/allProperties/update	Update a verifiable credential contract
microsoft.directory/verifiableCredentials/configuration/contracts/cards/allProperties/read	Read a verifiable credential card
microsoft.directory/verifiableCredentials/configuration/contracts/cards/revoke	Revoke a verifiable credential card
microsoft.directory/verifiableCredentials/configuration/contracts/create	Create a verifiable credential contract
microsoft.directory/verifiableCredentials/configuration/create	Create configuration required to create and manage verifiable credentials
microsoft.directory/verifiableCredentials/configuration/delete	Delete configuration required to create and manage verifiable credentials and delete all of its verifiable credentials